漏洞信息详情
MySQL yaSSL TaoCrypt的src/asn.cpp CertDecoder::GetName函数多个栈缓冲区错误漏洞
- CNNVD编号:CNNVD-200912-425
- 危害等级: 中危
- CVE编号: CVE-2009-4484
- 漏洞类型: 缓冲区错误
- 发布时间: 2009-12-30
- 威胁类型: 远程
- 更新时间: 2020-11-11
- 厂 商: mysql
- 漏洞来源:
漏洞简介
Oracle MySQL是美国甲骨文(Oracle)公司的一套开源的关系数据库管理系统。该数据库系统具有性能高、成本低、可靠性好等特点。
MySQL 5.0.90之前的5.0.x版本,MySQL 5.1.43之前的5.1.x版本,MySQL 5.5.x至5.5.0-m2版本的mysqld中使用的yaSSL 1.9.9之前版本中的TaoCrypt的src/asn.cpp中的CertDecoder::GetName函数中存在多个基于栈的缓冲区溢出漏洞。远程攻击者可通过建立一个SSL连接并发送带有特制名称字段的X.509客户端证书执行任意代码或者导致拒绝服务(内存破坏和守护程序崩溃)。
漏洞公告
目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
yaSSL yaSSL 1.0
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.0.1
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.0.2
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.0.3
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.0.4
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.0.5
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.0.6
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.7.5
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.9.6
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
Ubuntu Ubuntu Linux 9.10 sparc
Ubuntu libmysqlclient16_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/libmysqlclient16_5. 1.37-1ubuntu5.1_sparc.deb
Ubuntu libmysqld-dev_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/libmysqld-dev_5.1.3 7-1ubuntu5.1_sparc.deb
Ubuntu libmysqld-pic_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/libmysqld-pic_5.1.3 7-1ubuntu5.1_sparc.deb
Ubuntu mysql-client-5.1_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/mysql-client-5.1_5. 1.37-1ubuntu5.1_sparc.deb
Ubuntu mysql-server-5.1_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/mysql-server-5.1_5. 1.37-1ubuntu5.1_sparc.deb
Ubuntu mysql-server-core-5.1_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/mysql-server-core-5 .1_5.1.37-1ubuntu5.1_sparc.deb
yaSSL yaSSL 1.0
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.0.1
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.0.2
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.0.5
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.7.5
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
yaSSL yaSSL 1.9.6
yaSSL yassl-1.9.9.zip
http://yassl.com/yassl-1.9.9.zip
Ubuntu Ubuntu Linux 9.10 sparc
Ubuntu libmysqlclient16_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/libmysqlclient16_5. 1.37-1ubuntu5.1_sparc.deb
Ubuntu libmysqld-dev_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/libmysqld-dev_5.1.3 7-1ubuntu5.1_sparc.deb
Ubuntu libmysqld-pic_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/libmysqld-pic_5.1.3 7-1ubuntu5.1_sparc.deb
Ubuntu mysql-client-5.1_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/mysql-client-5.1_5. 1.37-1ubuntu5.1_sparc.deb
Ubuntu mysql-server-5.1_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/mysql-server-5.1_5. 1.37-1ubuntu5.1_sparc.deb
Ubuntu mysql-server-core-5.1_5.1.37-1ubuntu5.1_sparc.deb
http://ports.ubuntu.com/pool/main/m/mysql-dfsg-5.1/mysql-server-core-5 .1_5.1.37-1ubuntu5.1_sparc.deb
参考网址
来源:SECTRACK
链接:http://securitytracker.com/id?1023402
来源:CONFIRM
链接:http://yassl.cvs.sourceforge.net/viewvc/yassl/yassl/taocrypt/src/asn.cpp?r1=1.13&r2=1.14
来源:CONFIRM
链接:http://dev.mysql.com/doc/refman/5.0/en/news-5-0-90.HTML
来源:SECUNIA
链接:http://secunia.com/advisories/38344
来源:BID
链接:http://www.securityfocus.com/bid/37640
来源:MISC
链接:http://www.intevydis.com/blog/?p=57
来源:SECUNIA
链接:http://secunia.com/advisories/37493
来源:SECUNIA
链接:http://secunia.com/advisories/38364
来源:BID
链接:http://www.securityfocus.com/bid/37943
来源:SECUNIA
链接:http://secunia.com/advisories/38517
来源:MISC
链接:http://www.intevydis.com/blog/?p=106
来源:BID
链接:https://www.securityfocus.com/bid/37943
来源:CONFIRM
链接:https://bugzilla.redhat.com/show_bug.cgi?id=555313
来源:BID
链接:https://www.securityfocus.com/bid/37640
来源:MISC
链接:http://intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.HTML
来源:CONFIRM
链接:http://www.yassl.com/news.HTML#yassl199
来源:MISC
链接:http://www.metasploit.com/modules/exploit/linux/mysql/mysql_yassl_getname
来源:CONFIRM
链接:http://dev.mysql.com/doc/refman/5.1/en/news-5-1-43.HTML
来源:MISC
链接:http://intevydis.com/vd-list.sHTML
来源:UBUNTU
链接:http://ubuntu.com/usn/usn-897-1
来源:MISC
链接:http://intevydis.com/mysql_demo.HTML
来源:SECTRACK
链接:http://securitytracker.com/id?1023513
来源:CONFIRM
链接:http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1
来源:OSVDB
链接:http://www.osvdb.org/61956
来源:MISC
链接:http://intevydis.com/mysql_overflow1.py.txt
来源:XF
链接:https://exchange.xforce.ibmcloud.com/vulnerabilities/55416
来源:VUPEN
链接:http://www.vupen.com/english/advisories/2010/0236
来源:BID
链接:http://www.securityfocus.com/bid/37974
来源:MLIST
链接:http://lists.mysql.com/commits/96697
来源:SECUNIA
链接:http://secunia.com/advisories/38573
来源:VUPEN
链接:http://www.vupen.com/english/advisories/2010/0233
来源:BID
链接:https://www.securityfocus.com/bid/37974
来源:CONFIRM
链接:http://bugs.mysql.com/bug.php?id=50227
来源:CONFIRM
链接:http://www.yassl.com/release.HTML
来源:DEBIAN
链接:https://www.debian.org/security/2010/dsa-1997
来源:MLIST
链接:http://archives.neohapsis.com/archives/dailydave/2010-q1/0002.HTML
来源:MISC
链接:http://isc.sans.org/diary.HTML?storyid=7900
来源:UBUNTU
链接:http://www.ubuntu.com/usn/USN-1397-1
来源:MLIST
链接:http://lists.immunitysec.com/pipermail/dailydave/2010-January/006020.HTML
受影响实体
- Mysql Mysql:5.0.51a
补丁
暂无
![weinxin](http://zone.ci/zone_ci_images/zone.ci.png)
评论